Compliance 101 for Australian SMBs: Privacy Act, Essential Eight, ISO 27001 — What Actually Applies to You?

Compliance conversations fail because three very different things get mixed together: what the law requires, what the market expects, and what’s a nice-to-have certification. Untangle them and the path gets much clearer.

The law: Privacy Act 1988

If your business turns over more than $3 million — or handles health data at any size — the Privacy Act applies: handle personal information carefully (the 13 Australian Privacy Principles), protect it with "reasonable steps", and notify affected people and the OAIC if a breach is likely to cause serious harm. Reforms are progressively tightening this, and the small-business exemption is slated for removal — building good habits now is cheaper than retrofitting later.

The expectation: ACSC Essential Eight

Not law for private business, but the de facto Australian baseline: eight mitigation strategies (patching, MFA, backups, application control and friends) with maturity levels 0–3. Government tenders score it, insurers price against it, and enterprise customers audit their suppliers with it. For most SMBs, Maturity Level 1 is the right first target — achievable in weeks.

The badge: ISO 27001 (and friends)

ISO 27001 is an international certification for a full security management system. It’s powerful for winning enterprise and government work, and overkill for most sub-50-person businesses as a first step. A newer, lighter option — SMB1001 — offers tiered certification designed specifically for small business. Treat certifications as growth investments you take on when a contract or market demands them.

• Everyone: Privacy Act hygiene — know what personal data you hold, protect it, be breach-ready.
• Everyone: Essential Eight Maturity Level 1 as the practical security floor.
• When contracts demand it: SMB1001 or ISO 27001, built on the foundation above.

The good news: these all overlap heavily at the technical layer. Do the Essential Eight properly and you’ve done most of the Privacy Act’s "reasonable steps" and most of the groundwork for any future certification — one uplift, three outcomes.